Install CKBunker

Last updated: 2026-07-07 · Source-backed CKBunker/COLDCARD documentation.

CKBunker is installed from the open-source repository and run beside a COLDCARD connected over USB. Treat the first install as a lab exercise: confirm your Python dependencies, Tor setup, firmware support, and HSM policy behavior before using it with meaningful funds.

Requirements

• A supported COLDCARD connected over USB, with firmware that supports HSM mode.
• Python 3 and virtualenv. The historical repository requirements include pinned Python packages, so use a disposable environment.
• Tor if you want remote onion-service access. Local-only operation is safer for the first setup pass.
• A Tor-capable browser for remote use.
• A mobile TOTP app, recommended for HSM users.

Source install

git clone https://github.com/Coldcard/ckbunker.git
cd ckbunker
virtualenv -p python3 ENV
source ENV/bin/activate
pip install -r requirements.txt

Run locally first

Start local-only during setup. This keeps Tor and remote login out of the first test path and lets you verify that the host can talk to the COLDCARD before exposing anything remotely.

ckbunker --local

Then open the local web interface in your browser. The default development port in the original documentation is 9823.

Enable Tor access

When you are ready to operate remotely, run Tor on the same machine. CKBunker can publish itself as a hidden service and use Tor SOCKS for network operations. The hidden service protects the host's network location, but it does not make the host trustworthy; the COLDCARD policy remains the safety boundary.

ckbunker

Production checklist

• Confirm the exact COLDCARD model and firmware support HSM mode.
• Use a test wallet and fake/small PSBTs to exercise every policy rule.
• Confirm that local confirmation, TOTP authorization, whitelists, and velocity limits fail closed.
• Back up the policy and document who can reboot, unlock, or physically access the device.

Next

Continue with setup to configure the COLDCARD and Bunker settings.